CVE-2025-55971

{
  "id": "CVE-2025-55971",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-03T16:16:17.540",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) vulnerability via the UPnP MediaRenderer service (AVTransport:1). The device accepts unauthenticated SetAVTransportURI SOAP requests over TCP/16398 and attempts to retrieve externally referenced URIs, including attacker-controlled payloads. The blind SSRF allows for sending requests on behalf of the TV, which can be leveraged to probe for other internal or external services accessible by the device (e.g., 127.0.0.1:16XXX, LAN services, or internet targets), potentially enabling additional exploit chains."
    },
    {
      "lang": "es",
      "value": "TCL 65C655 Smart TV, ejecutando la versión de firmware V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), es vulnerable a una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) ciega y no autenticada a través del servicio UPnP MediaRenderer (AVTransport:1). El dispositivo acepta peticiones SOAP SetAVTransportURI no autenticadas sobre TCP/16398 e intenta recuperar URIs referenciadas externamente, incluyendo cargas útiles controladas por el atacante. La SSRF ciega permite enviar peticiones en nombre del TV, lo que puede aprovecharse para sondear otros servicios internos o externos accesibles por el dispositivo (p. ej., 127.0.0.1:16XXX, servicios LAN o objetivos de internet), lo que podría habilitar cadenas de exploit adicionales."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-03T19:07:53.330606Z",
          "id": "CVE-2025-55971",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:tcl:65c655_firmware:v8-r75pt01-lf1v269.001116:*:*:*:*:*:*:*",
              "matchCriteriaId": "1004749F-C65B-4868-85DB-6E135DFE71EC"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:tcl:65c655:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "71800B88-6570-4AA3-8968-A897A498739E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Szym0n13k/CVE-2025-55971-Blind-Unauthenticated-SSRF-in-TCL-Smart-TV-UPnP-DLNA-AVTransport",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.youtube.com/watch?v=FeNLGR_xFIA",
      "source": "[email protected]",
      "tags": [
        "Exploit"
      ]
    }
  ]
}